Pyramid connects to Analysis Services SSAS (both multidimensional / OLAP, Tabular), and Power BI Workspaces using a special Pyramid service: "Windows Connector". This service makes use of the OLE DB drivers unique to MS SSAS. There is a slightly different use of the same drivers for Azure Tabular (which should be flagged as such in the data card).
Connecting to SSAS
When connecting to SSAS and Power BI, Pyramid uses the "effective user" method - which offers the same security mechanisms as normal connections without the complexity of Kerberos configuration. There are 3 options available when selecting the authentication method:
- Alternative account Use the specified user name and password. A domain account needs to be added to the data card when setting up the data source, as described here.
- Global account Use the user name and password from the global account settings.
- Service account Use the user name and password that is running the Windows Connector service.
- If you are using the service account, the account normally has the right to run services. In all cases, the account must have administrative rights on the SSAS service itself. The account does NOT need to be a domain admin in Active Directory or have general administrative rights on the host machine, hosting SSAS. The SSAS instance and the server hosting the Pyramid Windows Connector must be on an Active Directory domain.
- For each user in the system, their user name credentials need to be given read access to the underlying cube and server. The setup here depends on the authentication provider chosen.
- If using Active Directory authentication, the user's inherent username (with domain) should be operable directly.
- If using SAML, OpenID or internal database authentication, the user's PROXY account (1 or 2) setting should be set with a domain account name that can be operable.
- In the event that embedded reporting is used, and the login to Pyramid is being done programmatically through APIs, the API authentication method can have the "Custom Data" property instead. This in turn can be used as the field to drive the authentication through to SSAS. Again, it should be populated with a domain account.
Ignoring Cube Security
A different option is to ignore user-level security on a cube altogether. Using this option still requires an admin account to connect to SSAS, but the details per user will be ignored.
Azure Tabular Services Connectors
Before connecting to an Azure SSAS Tabular server, you may need to manually install the latest client libraries on all "Windows Connector" machines. You can download the latest libraries here ( to download the MSOLAP x64 driver).
Connection Type
Choose the connection type that's been configured for your SSAS server. Both the Azure Tabular and Power BI Workspace connection types appear for tabular connections only.
Multi-Factor Authentication
Administrators need to deploy a special service account if your Azure data sources have been configured to prompt users with multi-factor authentication before the source can be accessed. The service account should have its "MFA" turned off - so it does not to a prompt for access. When combined with the 'effective user name' mechanism, the
Multi Pass Authentication
If authentication via impersonation (Windows Authentication/ Kerberos) fails, Multi Pass Authentication can be used to cascade through multiple authentication options, such as username/ password. The authentication options that Pyramid will try via Multi Pass Authentication will depend on the set up of your server.
The final authentication option that Pyramid will try is the account machine; Pyramid will only try to connect in this way if 'Account Machine Fallback' is enabled.